Bridging the Air Gap
What this domain tests
The exam tests whether you understand what a true air gap is, how it erodes in practice, and how to transfer data or updates across it without creating a network bridge. Expect questions on removable media, staging, scanning, data diodes, and procedural controls.
Core rules
- An air gap means no network path between the OT and IT environments. It is a property of the architecture, not a policy statement.
- Gaps erode through USB drives, vendor laptops, wireless links, cellular modems, dual-homed hosts, and remote-support tools. Find and control every path.
- For outbound data, a data diode enforces one-way transfer. It should break the protocol, not just filter packets, and it must be installed in the correct direction.
- For inbound patches and files, use a staged transfer: dedicated kiosk or transfer station, malware scanning with multiple engines, integrity verification, approval, and a controlled transfer medium.
- Log every transfer, label media, scan again at the destination, and keep the transfer station patched and isolated from both networks.
- Policies must cover visitors, contractors, and vendor laptops, not only employees.
Worked example
A plant must send historian summaries to corporate analytics but refuses a routed connection. Reasoning: deploy a data diode from the OT DMZ to the IT DMZ. The OT side sends a one-way replicated stream; the IT side receives it. No TCP session is initiated from IT into OT, and no return path exists. For vendor firmware, stage the file on the transfer kiosk, scan it, verify the hash against the vendor advisory, get change approval, and move it with a managed USB device. That preserves the gap for both directions.
Traps
- Believing an air gap is absolute when a dual-homed workstation exists.
- Using antivirus as the only control on removable media.
- Connecting a vendor laptop directly to the control network just for the update.
- Installing a data diode in the wrong direction or assuming it is bidirectional.
- Forgetting that firmware and configuration files are transfer paths too.